Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint POST /user/invited does not validate any invite token, authentication header, or session. Any unauthenticated attacker can call this endpoint directly to create a fully active account and receive a valid JWT — even when the instance has existing users and signupRestricted is enabled. This bypass is distinct from the normal registration endpoint (POST /user) which enforces signupRestricted and sets active: false pending verification. This issue has been patched in version 5.0.0.
Problem types
CWE-306: Missing Authentication for Critical Function
Product status
References
github.com/...rtbrew/security/advisories/GHSA-g47g-v5cp-j8hp
github.com/chartbrew/chartbrew/releases/tag/v5.0.0